Question

A multinational financial services company must demonstrate continuous compliance with PCI DSS across its Azure production subscriptions. The compliance team needs an automated way to (1) assess current resource configurations against the PCI DSS control set, (2) continuously flag drift as new resources are deployed, and (3) produce evidence reports for auditors showing pass/fail status per control. The security architect wants to minimize custom tooling. Which design best meets these requirements?

Accepted Answer

Enable the PCI DSS regulatory compliance standard in Microsoft Defender for Cloud, which maps built-in Azure Policy assessments to control requirements and surfaces a compliance dashboard with per-control pass/fail evidence.

Answer

Deploy a Microsoft Sentinel workbook that ingests activity logs and manually correlate resource changes against a spreadsheet of PCI DSS controls maintained by the compliance team.

Answer

Configure Microsoft Purview Compliance Manager assessment templates only, and rely on its improvement actions to track Azure resource configuration state.

Answer

Author a full set of custom Azure Policy definitions from scratch for every PCI DSS requirement and export policy state via Azure Resource Graph queries into a custom Power BI report.